Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

Did you read the paper? The whole point of the thing is to make it non-parallelizable. That's what makes it hard.


I did not read it, but I can't imagine what would prevent an attacker from running a parallel attack on multiple circuits/computers that aren't sharing any resources...


The idea is to make the KDF expensive in space as well as time. While bcrypt costs a few seconds of CPU time, it uses only a tiny amount of RAM, thus underutilizing the resources you have available. Thus, you can parallelize an attack using lots of specialized ASICs but only a commodity amount of storage. Scrypt would require you to purchase lots of RAM for every ASIC, making a brute force attack much more costly.


Thus, you can parallelize an attack using lots of specialized ASICs...

More to the point, you can parallelize attacks on most KDFs by building an ASIC with many copies of a password-cracking circuit. With scrypt, the vast majority of the IC area (and thus cost) is RAM.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: